Business Continuity Management (BCM) Consulting

Business continuity management (BCM) makes sure your organisation can keep delivering its most important services through a disruption, and recover the rest in a planned order. Security Solution Consultants (SSC) provides business continuity management consulting services and business continuity services across Australia and New Zealand: business impact analysis, continuity strategies, plans that people can use under pressure, exercises that test them, and alignment with ISO 22301 and APRA CPS 230.

Disruptions rarely look like the scenario in the plan. A ransomware attack, the failure of a cloud or payments provider, a flood that closes a building, or the loss of key staff can all stop critical operations. Good BCM prepares you for the impact, whatever the cause.

Our business continuity management services

• Business impact analysis (BIA). Identify critical services and processes, the impact of disruption over time, and the people, technology, data, sites and suppliers they depend on.
• Recovery objectives. Set maximum tolerable periods of disruption, recovery time objectives (RTO) and recovery point objectives (RPO) that the business agrees with and IT can deliver.
• Continuity strategies. Workarounds, alternate sites, remote work, manual processing, supplier alternatives and IT disaster recovery options, compared by cost and recovery capability.
• Business continuity plans. Short, role-based plans with activation criteria, contact lists, decision rights and step-by-step recovery actions.
• IT disaster recovery planning. Recovery plans for critical systems, backup and restore testing, and alignment of cloud and hybrid recovery with business priorities.
• Crisis management and communications. Crisis team structure, escalation, stakeholder and media communication, aligned with ISO 22361 crisis management guidance.
• Exercises and testing. Tabletop exercises, walkthroughs and technical recovery tests, with written findings and improvement actions.
• ISO 22301 readiness. Building a business continuity management system that can be certified by an accredited certification body.

Business impact analysis: the foundation of BCM

Every good continuity program starts with a business impact analysis. Through interviews and workshops we work out which services matter most to customers, revenue, safety and obligations, how quickly the impact grows when they stop, and what each one depends on. The result is a ranked list of critical activities with agreed recovery objectives, and a dependency map that often reveals single points of failure nobody had written down: one key person, one supplier, one spreadsheet or one legacy system.

We also look beyond your own walls. Many critical services now rely on cloud platforms, payment providers and outsourced operations, so supplier dependencies and their own continuity arrangements are part of every BIA we run.

Our BCM framework

1. Program governance. Policy, scope, roles, a BCM steering group and reporting to the executive and board.
2. Business impact analysis and risk assessment. Critical activities, recovery objectives, dependencies and the disruption scenarios most likely to affect them.
3. Strategy selection. Practical options to meet recovery objectives, with costs and trade-offs explained.
4. Plan development. Business continuity, IT disaster recovery and crisis management plans that link to each other.
5. Exercising and testing. A yearly program that tests plans against severe but plausible scenarios.
6. Review and improvement. Lessons learned from exercises and real incidents feed back into plans and priorities.

Exercises that build confidence

A plan that has never been exercised is a theory. We design and facilitate exercises for executives and operational teams, from a two-hour tabletop discussion of a ransomware attack to a full technical recovery test of a critical system. Each exercise has clear objectives, realistic injects and an independent observer, followed by a short report of what worked, what did not, and who will fix it by when.

ISO 22301 and APRA CPS 230

For APRA-regulated entities we build continuity arrangements around critical operations and tolerance levels, so the same work satisfies CPS 230 and prepares you for ISO 22301 if you choose to certify. See our CPS 230 compliance guide and certification and accreditation services.

Cyber resilience and business continuity

Ransomware has made cyber incidents the most common reason continuity plans are activated. We connect your business continuity, IT disaster recovery and incident response plans so that decisions about isolating systems, restoring from backups and communicating with customers are made once, by the right people. We also check that backups are protected, tested and can actually be restored within your recovery objectives.

Supplier and third-party continuity

When a critical supplier fails, your plan is only as good as theirs. We help you identify which suppliers support critical services, review their continuity and disaster recovery evidence, agree notification and recovery commitments in contracts, and plan realistic alternatives such as a second provider, manual workarounds or a controlled reduction in service. For APRA-regulated entities this links directly to the material service provider requirements in CPS 230.

What you receive

• A business continuity policy and program charter approved by the executive
• A business impact analysis report with critical activities, recovery objectives and dependency maps
• Continuity strategy options with costs and recommendations
• Business continuity, IT disaster recovery and crisis management plans that link to each other
• An annual exercise program, exercise reports and an improvement action register
• For ISO 22301 clients, the documented information and internal audit needed for certification

Signs your continuity plan needs attention

• The plan has not been updated since a major system, site or supplier change.
• Recovery time objectives were set by IT without agreement from the business.
• Nobody outside the risk team knows where the plan is or what their role is.
• Backups exist, but a full restore of a critical system has never been tested.
• The last exercise was a document review rather than a realistic scenario.

Industries we support

• Banks, insurers and superannuation funds under APRA CPS 230
• Energy, water and other critical infrastructure under the SOCI Act
• Healthcare and aged care providers
• Technology and cloud service providers with customer uptime commitments
• Government agencies, councils and not-for-profit organisations

BCM supported by GRCLens

Business continuity programs decay when plans live in documents nobody updates, which is why we pair our consulting with a BCM solution. GRCLens holds your BIA, recovery objectives, plans, exercise results and actions in one place, links them to risks and controls, and reminds owners when reviews are due. For crisis capability, the ISO 22361 module assesses your crisis management arrangements.

Related services: enterprise risk management, incident response and recovery and data protection and backups. To start with a business impact analysis, contact our team.